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1 . INTRODUCTION 


Oxygen is a relatively energetic reactant at normal ambient condi- 
tions and becomes more highly reactive with increases in pressure. At 
very high pressures it becomes extremely reactive. The successful design, 
development and operation of high pressure oxygen systems requires special 
knowledge of materials, design practices, test phenomena, and manufacturing 
and operational techniques. 

During the course of the manned space flight programs, a great deal 
of research and testing has been conducted by the Government and its con- 
tractors to develop high pressure oxygen systems used in the propulsion, 
power, and life support systems of manned vehicles. To support such varied 
applications, testing has covered a broad spectrum of environmental and 
operating conditions. As a result of this research and testing, a wealth 
of test data and knowledge has been amassed on the reactivity of a wide va- 
riety of metallic and nonmetallic materials in high pressure environments. 
(For example, ref. 3, JSC-02681.) Another current data base on the prop- 
erties and behavior of oxygen in its various states has been compiled in 
the nine-volume Oxygen Technology Survey, sponsored by NASA's Aerospace 
Safety Research and Data Institute (ASRDI), 1972-1975 (ref. 1). Addition- 
ally, in reference 2, Clark and Must have provided a thorough review of a 
large number of reports on the oxygen compatibility of both metallic and 
nonmetallic materials. These and other related sources published in the 
current literature are indeed useful in providing a guide to the designer 
for the selection of materials and for determining generalized design 
approaches for oxygen components and systems. However, many of the design 
subtleties, techniques, and related knowledge, presently in use in aero- 
space applications, have not been adequately reported in the literature. 

Our experiences have proved that a successful high pressure oxygen 
system is not necessarily achieved merely by selecting the most oxygen 
compatible materials available. Because, even the best materials have 
limitations, innovative design features and techniques must be employed to 
make up for material deficiences. Space program engineers have gained con- 
siderable understanding of the effects of geometry on the design of oxygen 
system components and have developed design features directed at overcom- 
ing some of the physical limitations of materials. Much has been learned 
about unsafe and undesirable design practices. Advancing technology, with 
the attendant demand for storage and use of oxygen at increasing pressures 
and flow rates, makes it imperative that this design expertise and knowl- 
edge be well understood and documented for application by the future devel- 
opers of space flight hardware. 

Therefore, the primary purpose of this handbook is to document and 
provide a repository for critical and important detailed design data and 
information, hitherto unpublished, along with significant data on oxygen 
reactivity phenomena with metallic and nonmetallic materials in moderate 
to very high pressure environments. The authors, representing several di- 
visions of the Engineering and Development Directorate of the Johnson 
Space Center and its White Sands Test Facility, have compiled and format- 
ted this data and information to provide a ready and easy to use reference 
for the guidance of designers of future propulsion, power and life support 
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systems for use in space flight. This document, which very clearly illus 
trates both good and bad design practices, is applicable not only to aero 
space designs, but also to designs for industrial and civilian uses of 
high pressure oxygen systems. The information presented herein are der 
rived from data and design practices involving oxygen usage at pressures 
ranging from about 20 psia to 8000 psia equal with thermal conditions 
ranging from room temperatures up to 500° F. 
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2. IGNITION MECHANISMS 


The number of potential ignition sources that could be present in 
even a simple component intended for high pressure oxygen service is quite' 
large and varied. For example, electrical sensors or heaters can fail and 
cause arcing, sparking or overheating which lead to ignition. Small con- 
tamination particles, both metallic or nonmetallic, can be accelerated to 
sonic velocities in high flow regions of the component and lead to impact 
ignition of susceptible materials. Contamination can also collect in stag- 
nant regions of a component and be heated to ignition by pneumatic shock 
or adiabatic compression. 

Actuation can cause impact loading of valve seats or other detail 
parts resulting in failure of the parts or mechanically induced ignition. 
Failure to consider material hardness differences can result in galling 
of rubbing surfaces which can cause both functional failure or ignition. 
Chatter and subsequent fretting can result from unbalanced airloads. 

Cavity resonance leading to ignition of trapped contaminants can occur 
in blind passages upon system actuation. Flow induced vibration leading to 
system failure can also occur in bellows and lines where system design of 
support structure is not adequate. Flow induced cavitation in LO 2 systems 
may result in formation of ignition susceptible fresh surfaces. 

Consideration of ignition mechanisms should include all of those fac- 
tors listed above and should be covered during design of both components 
and systems. While this listing covers the most frequently observed igni- 
tion sources, it is not considered to be exhaustive. A careful failure 
modes and effects analysis which includes ignition as a failure mechanism 
should be conducted as a part of each new design. 
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3. MATERIAL SELECTION 


Materials currently used in high pressure oxygen systems range from 
ignition-resistant materials like Monel 400 to materials of widely varying, 
ignitability like butyl rubber and the silicones. The range of ignitabil- 
ity as a function of pressure is illustrated in figure 1 for nonmetallics 
and in figure 2 for metals. 

The material selection process has historically been guided by consid- 
erations of functional acceptability and light weight, with only secondary 
consideration being given to the possibility - or ease - of ignition. 

Many currently used materials appear to work primarily because the design 
in some way protects the ignition-susceptible material or because no parti- 
cle with sufficient energy to ignite the system has yet impacted it. 

While functional performance is obviously a very important requirement in 
the design of high pressure oxygen systems, the incidence and severity of 
fires indicates that selection based on ignition resistance is at least 
equally important. 

While material selection alone cannot preclude ignition from these 
mechanisms, proper choices can markedly reduce the probability of igni- 
tion. For example, ignition Induced by mechanical impact can be minimized 
by selecting valve seats and balls that do not shatter under normal load- 
ing. Galling can be largely eliminated if potential rubbing surfaces are 
made from materials with widely differing hardnesses. For all types of ig- 
nition mechanisms, selecting materials that have relatively small exother- 
mic heats of combustion (like Monel 400 and Inconel 718) will reduce not 
only the probability of ignition but also the probability of propagation. 
Materials with high heats of combustion (stainless steels) or very high 
heats of combustion (aluminum alloys) should be avoided wherever possible. 

A summary of typical heats of combustion as well as other properties for 
some currently used materials is given in table 1, 


MATERIAL TESTS 

Over the past 20 years a large number of different types of tests 
(ref. 2 - ASRDI, Vol. IX, 1975) have been developed and evaluated by vari- 
ous groups, both public and private. In an attempt to find test methods 
that would predict materials behavior in planned applications. For non- 
metallic materials, both mechanical and pneumatic impact tests have been 
studied. For metals, tests studied have included promoted ignition, me- 
chanical and particle impacts, rubbing or rotating friction, and arc or 
spark ignition, with a number of variations on each type. To date, no sin- 
gle test has been developed that can be applied to all materials, both 
metals and nonmetals, to produce either consistent relative rankings or ab- 
solute ignition limits as a function of oxygen pressure alone. The tests 
that appear to show the greatest predictive ability are as follows. 

1. Nonmetals - Test No. 13 in NHB-8060.1B, "Ambient Liquid Oxygen and 
Pressurized Liquid and Gaseous Oxygen Mechanical Impact Tests" (ref. 4) 
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OF POOR QUALITY 


Material 


Alumina 
Teflon, PTFE 
Teflon, glass'filleci 

Asbestos 

Viton Rubber 1502 
Viton Rubber 

(Parker Seal V747-70) 
KEL-F 
Teflon, FEP 
Silicone rubber 

(Parco Seal 1235*70) 
Vespel SP-21 
Nylon 

Tecfiuorfil B 
Vespel SP-21 1 
Vespel SP-1 
Silastic 675 
Ty-Piy-3 adhesive 
Neoprene Rubber 
Chloroprene 

(Parker Seal C-557) 
Loctite 222 

EPR (Parker Seal E-529) 
Butyl rubber 
Epoxy glass laminate 
Eccobond 104 
M-Bond 610 
Noryl plastic 


Pressure, 1000 Ib/in2 
2 3 4 5 6 








Not ignitabie 
Ignition varies with lot 
Always ignites 


Pressure, MN/m2 


Figure 1.- Range of ignitability for nonmetallics. 
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Material 

Gold 
Silver 
Nickel 
Monel 
Inconel 
MP35N alloy 
Beryllium copper 
Aluminum bronze or 
Phosphor bronze 
Copper 
Elgiloy 
Hastelloy 
Ni-Span C 
Brazing alloys 
A-286 alloy 
PH stainless steels 
Stainless steels 
Aluminum alloys 
Stellite or Stoody 2 
Tungsten carbide 
with 10% cobalt 
Brass 

Molybdenum /rhenium 
Permendur 2-V 
Samarium cobalt 
Magnesium 
Solder 
Carbon steel 
K-601 (Kennametal alloy) 


Pressure, 1000 Ib/in^ 
2 3 4 5 6 




2 Not ignitable 



V/////ZA Ignition varies with lot 
Always ignites 


10 20 30 40 

Pressure, MN/m^ 


Figure 2.- Range of ignitability for metals 
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This test is a modified form of the Army Ballistic Missile Agency 
(ABMA) impact test, which has been in use for over 20 years. A schematic 
of the test fixture is shown in figure 3. In essence, samples of the mate- 
rial being tested are impacted at 368 ft-lb/in^ (772 kJ/m^) with oxygen at 
the pressure and temperature of intended use. Twenty specimens are tested 
from each lot of material. If two or more specimens react, the lot is 
rejected. If only 1 specimen of 20 reacts, an additional 40 specimens are 
tested and, if no more reactions occur, the lot is accepted. Thousands of 
materials have been tested and, to date, no component ignitions have been 
attributable to materials that have passed this test when used within the 
limits (temperature, impact energy, and pressure) of the test envelope. A 
comprehensive listing of test results obtained for a wide variety of mate- 
rials is given in JSC-02681. 

2. Metals - White Sands Test Facility (WSTF) Particle Impact - 
TR-277-001 - "Metals Ignition Study in Gaseous Oxygen" 

This recently developed test has demonstrated the ability to discrimi- 
nate between ignitable and non-ignitable metals at pressures up to 6000 Ib/in^ 
(41 MN/m^). The test fixture in figure 4 involves impact of candidate metal- 
lic specimens with typical particles in the 100 to 1000 micron range at sonic 
velocities with oxygen at the temperature and pressure of intended use. Ex- 
perience to date indicates that this test could be adopted as a meaningful 
method for selecting metals for use in oxygen systems. 

The particle ignition pressure is defined as "the pressure below 
which the maximum sized particle which can penetrate the components fil- 
ters and moving at sonic velocity will not ignite the material." 


BATCH/LOT TESTING 

As is readily apparent from the data shown in figure 1, many nonmetal- 
lic materials show a significant range of reaction pressures when differ- 
ent lots of material from the same source are tested using identical 
methods. The reasons for this variability are not understood in detail 
and are probably different for each material tested. As a result, predic- 
tion of the test behavior of a given lot of material is possible in only 
a limited number of cases. Except for materials that have been proved ac- 
ceptable by tests of at least 10 lots of material without a single fail- 
ure, each new lot of material must be experimentally proved acceptable. 
Materials that have passed the necessary testing and have been found to be 
insensitive to batch/lot variation are shown in table 2. 

When the materials that will function in a design range from those 
that do not require batch control to those that always ignite at the de- 
sign pressure, the selection logic varies with the sensitivity of the mate- 
rial. Figure 5 illustrates the selection and control logic we have devel- 
oped for high pressure oxygen systems. It should be noted that using 
batch/lot insensitive and batch/lot tested materials below their ignition 
pressure significantly simplifies the test requirements, documentation, and 
review. 
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Pneumatic amplifier 
chamber GN2 cavity 

Pneumatic 
amplifier chamber 


Sightglass 
for photocell 

Pressurization port 

High pressure 
chamber 


High pressure seal 



Equalizer pin anvil 

Equalizer pin 
Pneumatic amplifier 
diaphragm 


High pressure seal 

Vent port 

Striker pin 
Sample cup 

Anvil nut 


Figure 3.- Pressurized mechanical Impact test chamber drawing. 
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(specimen) 


Figure 4.- White Sands Test Facility high velocity (sonic) Impact 
plate test fixture. 


3-7 



ORIGINAL PAGS IS 
OF POOR QUALITY 



Figure 5.- Nonmetallic materials control logic. 
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TABLE 2.- MATERIALS THAT DO NOT REQUIRE BATCH CONTROL 


Materi a1 

Type of Material 

Fluid 

Max. temp., 
OF (K) 

Max. pressure, 
lb/in2 (MN/m2) 

*Everlube 812 

Dry film lubricant 

GOX 

530 

(550) 

5500 

(38) 



LOX 

-297 

(90) 

1000 

(6.9) 

♦Microseal 100-1 

Dry film lubricant 

GOX 

200 

(366) 

1000 

(6.9) 



LOX 

-297 

(90) 

Ambient 

♦Microseal 200-1 

Dry film lubricant 

GOX 

200 

(366) 

3300 (23) 



LOX 

-297 

(90) 

1000 

(6.9) 

♦Triolube 1175 

Dry film lubricant 

GOX 

350 

(450) 

3300 (23) 



LOX 

-297 

(90) 

1000 

(6.9) 

Krytox 240 AB 

Grease 

GOX 

250 

(394) 

1000 

(6.9) 



LOX 

-297 

(90) 

1000 

(6.9) 

Krytox 240 AC 

Grease 

GOX 

150 

(339) 

6000 (41) 

Braycote 3L-38RP 

Grease 

GOX 

540 

(555) 

4400 

(30) 




-297 

(90) 

1000 

(6.9) 

Teflon. PTFE 

Plastic 

GOX 

250 

(394) 

1000 

(6.9) 



LOX 

-297 

(90) 

1000 

(6.9) 

25X glass-filled 

Plastic 

GOX 

150 

(339) 

1000 

(6.9) 

Teflon 


LOX 

-297 

(90) 

1000 

(6.9) 

Rulon A 

Plastic 

LOX 

-297 

(90) 

600 

(4.1) 

KEL-F 

PI astic 

GOX 

150 

(339) 

500 

(3.4) 



LOX 

-297 

(90) 

400 

(2.8) 

Vi ton Rubber 1542/1441 

El astomer 

GOX 

250 

(394) 

135 

(0.93) 

Tecfluorfil B 

Plastic 

GOX 

200 

(366) 

200 

(1.4) 



LOX 

-297 

(90) 

275 

(1.9) 

Vespel SP-1 

Plastic 

GOX 

150 

(339) 

250 

(1.7) 

Vi ton Rubber (Parker 

El astomer 

GOX 

150 

(339) 

250 

(1.7) 

Seal V747-70) 







Armalon TG-4060 

Fabric 

GOX 

275 

(408) 

400 

(2.8) 


*Maximuni use pressure on these dry film lubricants is the maximunt pressure where 
10-batch data are available. These lubricants may be acceptable at higher pressures, 
but additional testing is required for proof. 
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CONFIGURATION TESTING 


If it is not possible to find, even with batch/lot testing, materials 
that meet the functional requirements of a design, it may be possible to 
provide sufficient protection from ignition to permit use of a susceptible 
material. If this design approach is used, then it is mandatory that the 
adequacy of the design be demonstrated by configuration testing at condi- 
tions more severe than the expected worst-case use environment for the com 
ponent in question. 

For configuration testing to be considered valid, the tests should be 
conducted on hardware identical to the proposed use hardware. Substitute 
nonmetallics should be batch/lot tested to provide a replacement baseline 
even though the material will not pass the standard impact tests in the 
expected use environment. Only nonmetallics that equal or exceed the 
batch/lot rating of the original material used in the configuration tests 
should be used to refurbish the components. 

The configuration tests should use oxygen pressures at least 10 per- 
cent above the worst-case use condition. Expected temperature limits 
should be exceeded by at least 50° F (24 K). And, if the material is to 
be subjected to rapidly changing pressures, the pressure rise rate used in 
the configuration tests should be at least twice that which the component 
is expected to experience In operation. 

If cycling or multiple reuse of the component is a design require- 
ment, then the configuration testing should exceed by a factor of 4 the 
expected number of cycles or reuses. Failure of the configuration test 
article before completion of the required number of cycles would limit 
the use life of the component to 1/4 the number of cycles actually com- 
pleted before failure. 


MATER lAL RECOMMENDAT IONS 

The materials listed in table 3 have demonstrated superior resistance 
to Ignition and fire propagation in high pressure oxygen systems. Valve 
and pressure vessel materials are examples. The stainless steels normally 
used for valve stems, bodies, and springs are potentially combustible in 
high pressure oxygen systems. Monel alloys, which are self-extinguishing 
In oxygen fires, are available in the necessary range of hardnesses. K- 
Monel can be used for the valve stem and 400-series Monel for the valve 
body. Springs can be wound from Monel wire. Though small diameter Monel 
wire Is not currently available, miniature springs can be made of Elgiloy. 
Sapphire poppet balls should replace tungsten carbide or steel balls be- 
cause sapphire has a lower level of reactivity (and therefore is less 
combustible) than either tungsten carbide or steel and It is more resist- 
ant than tungsten carbide to breakup under a mechanical impact. Titanium 
and its alloys, normally attractive as candidate materials for pressure 
vessels because of their high strength-to-weight ratios, cannot be used 
for oxygen vessels because they are impact sensitive in oxygen. Inconel 
is a good choice for tie vessels to contain high pressure oxygen. Utiliza 
tion of these materials, particularly when they are used in conjunction 
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TABLE 3.- RECOMMENDED MATERIALS 


Application 
Component bodies 

Tubing and fittings 

Internal parts 

Springs 

Valve seats 


Material 

Monel 

Inconel 718 
Monel 

Inconel 718 
Monel 

Inconel 718 
Beryllium copper 

Beryllium copper 

Elgiloy 

Monel 

Gold or silver over 
Monel or Inconel 718 


Valve balls Sapphire 

Lubricants Batch/lot tested* Braycote 3L-38RP 

Batch/lot tested* Everlube 812 
Krytox 240 AC 

0-seals and backup rings Batch/lot tested* Vlton 

Batch/lot tested* Teflon 


Pressure vessels Inconel 718 

*Usage should be limited to temperatures less than or equal to those 
listed in table 2, 


Note: Titanium and its alloys are impact-sensitive in oxygen atmos- 

pheres and therefore may not be used in oxygen systems. 
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with the design, manufacturing, inspection, and test techniques recom- 
mended in other sections of this document, should result in components 
with the lowest risk of fire possible in today's state of the art. 

In no case should an alloy be used at an oxygen pressure above its 
particle Ignition pressure. This criterion would limit the use of alumi- 
num alloys and stainless steels to pressures below 1050 Ib/in^ (7.24 MN/m^) 
to allow some margin for error in test results and impact predictions. 

Only those nonmetal lie materials which have been found to be 
batch/lot insensitive or have been batch/lot tested should be used for 
original or replacement component parts. Even in cases where the design 
is justified by configuration testing, only those materials which have 
been shown by test to be at least as good as those used in the configura- 
tion tests should be used. 

Off-the-shelf equipment or slightly modified current designs should 
not be used in high pressure oxygen systems to save money, time, or 
weight, unless it can be shown that at the operating pressure limit the ma- 
terials used are "not ignitable" in accordance with the values given (with 
some margin) in figures 1 and 2. 
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4. COMPONENT DESIGN 


The purpose of this section is to document improved high pressure oxy- 
gen component design techniques which have been developed. The examples * 
that follow are drawn from actual oxygen systems. Most of the problems 
illustrated were discovered in hardware tests or use and the solutions 
shown are, for the most part, those 'which we have successfully implemented. 
In these examples, we offer specific suggestions for the design of compo- 
nent housings and valve parts, for the use of seals and filters, and for 
the design of ancillary equipment. The major problems addressed include 
ignition of metallics and nonmetallics, adiabatic compression, mechanical 
overstress, seal erosion, and contamination generation and control. Some 
of the guidelines are intended for use in original design, where maximum 
benefit can be obtained. Others are examples of less-than-ideal config- 
urations, each of which proved to be the best achievable fix to a problem 
that occurred in an existing component. 

The designer is cautioned that in addition to the standard analyses 
relating to component or system function (stress, throughput, etc.) there 
are certain additional special analyses that are considered mandatory to 
the proper design of oxygen systems and which must be considered in the de- 
sign process. These are as follows. 

1. Examination of regions for the generation of potential acoustic 
resonant conditions and also where particulate contamination 
could be accelerated to high velocities. 

2. Calculation of mechanical impact energies for moving parts, par- 
ticularly valve seats and poppets. The impact energies should be 
kept as low as possible, with values less than 10 ft-lb/in^ 
clearly being safe. 

3. Pressure rise rates caused by actuation should be determined. 
Values below 2000 psi/second are considered acceptable. 

4. Resonant frequencies of lines and components should be compared 
to flow induced component frequencies to insure that flow condi- 
tions do not generate destructive vibrations. 

5. Failure modes and effects analyses should consider not only the 
known and potential ignition mechanisms but also the effects of 
component functional failures. 

6. Single barrier failure analyses should be conducted to determine 
whether barrier failures or leaks can expose susceptible materials 
to high pressure oxygen. 

7. To prevent cavitation in liquid oxygen (LO2) systems an analysis 
should be conducted to insure that the system pressures exceed 
the LO? vapor pressure by at least 2 psi for all flow conditions 
which the system is expected to see. 
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COMPONENT HOUSINGS 


The housing generally contributes the greatest proportion of weight 
and combustible matter to the component assembly. This mass is due to its 
function as the enveloping structure and as a pressure containment vessel, 
which requires substantial material thickness to keep stresses acceptably 
low. Since housings do constitute so much of the mass, the selection of 
housing material is especially important in fire-sensitive oxygen systems. 

High pressure oxygen system components for portable or flight use 
must be lightweight, so it may appear to be desirable to build their hous- 
ings from such lightweight metals as aluminum. Such metals, however, have 
limited fire resistance and their use results in an increased combustion 
hazard. Aluminum may be used for an oxygen system only when pressure, 
flow velocity, and pressurization rates are low. In such applications, an 
analysis of adiabatic heating should be performed to assure acceptability. 
For higher pressures, higher flow velocities, or higher pressurization 
rates. Monel and similar alloys, which have much greater fire tolerance, 
must be used and the additional weight penalty accepted as necessary for 
system safety. 

To offset this additional weight, some weight reduction techniques 
can be used, such as trimming the exterior surfaces in areas where stress 
levels are low. However, the designer should use caution. Some guide- 
lines on using this technique and on avoiding hazardous thin walls, blind 
passages, feathered edges, burrs, and flow impingements are included in 
the following discussion of component housing problems and solutions to 
them. 
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Thin Walls 
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Problem: 

The walls between inner cavities or passageways and the outer surface of 
component housings may become so thin that stress concentrations result 
when pressure is introduced. Since geometries both inside and outside can 
be complex, it may not be obvious from drawings or even from direct inspec- 
tion that such thin, highly stressed areas exist. If such walls become 
too thin, they may rupture under pressure loading. This sudden rupture re- 
sults in an energy conversion that raises the temperature in the rupture 
zone. The failed section can expose bare, jagged metal which oxidizes rap- 
idly and hence initiates and supports combustion. Figures 6a and 6b illust- 
rate a thin wall condition. 


Solution: 

An extremely valuable technique for locating such stressed areas is to 
machine a clear plastic model of the housing. This model permits viewing 
inner and outer surfaces simultaneously. While exact wall thicknesses 
cannot be measured directly, the thin areas do become obvious. Such an 
indication should prompt more detailed layout analysis and tolerance study 
followed by stress analysis of the local area to determine whether a prob- 
lem actually exists. Tolerances then called out on the manufacturing 
drawing should be tight enough to preclude stress concentrations. 

The thin wall in the figure is primarily the result of an overdrill due 
to lack of attention during design or to an overtolerance. The dimen- 
sions of a drilled intersection should be planned more carefully or the 
tolerances set more tightly. It may even be possible to eliminate the in- 
tersection altogether as shown in figure 6c. All intersections should be 
examined by X-ray or borescope to ensure that the drilling was accomplished 
in an acceptable manner. 



Figure 6.- Component housings - Thin walls. 
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Blind Passages or Dead End Cavities 
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Problem: 

A stagnant area at the end of a drilled passage tends to collect debris 
either from manufacture or from normal use. During rapid pressurization 
of gaseous oxygen and its attendant compression heating, the debris be- 
comes fuel for ignition. When an underexpanded jet impinges on (or flows 
across) a stagnant cavity, a periodic pressure wave may be formed that os- 
cillates in the cavity, heating the gas within it. If particles are pres- 
ent, hot gaseous oxygen could ignite them. Blind passages and dead end 
cavities also present increased difficulty during cleaning. They require 
that the part be turned during soaking to eliminate air pockets. And spe- 
cial nozzles or extensions must be used to flush such diff icult-to-reach 
areas. Figure 7a depicts a blind passage created by plugging a drilled 
passage. Figure 7b depicts a dead end cavity created by overdrilling an 
intersecting passage. 


Solution: 

Gaseous oxygen components should be designed so that a jet will not im- 
pinge on or flow across a stagnant cavity. Jets should be gradually 
expanded and stagnant cavities should be eliminated or kept as shallow as 
possible. In figure 7a the blind passage can be eliminated by making the 
counterbore for the plug much deeper and installing the plug closer to the 
regulator stem. The cavity may not be completely eliminated, but the 
total dead volume is significantly reduced. The cavity shown in figure 7b 
can be eliminated by paying careful attention to dimensions and tolerances 
or, preferably, by redesigning to eliminate the intersecting holes. In- 
spection with a borescope can be done to verify that passageway lengths 
are within tolerance. 



Figure 7.- Component housings - Blind passages or dead end cavities. 
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Sharp Feathered Edges 
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Problem: 

Sharp feathered edges are surfaces with large areas but little mass. In 
an environment where compression heating, shock heating, or flow friction 
is present, there may be insufficient mass of metal to conduct heat away. 
Thus, heat can concentrate in such an edge and it can become an ignition 
point. Any two intersecting passages that are drilled off center or at an 
angle other than 90 degrees will produce an edge feathered to some degree. 
Other machining situations may also cause a feathered edge. Figure 8 de- 
picts a feathered edge caused by an offcenter drill intersection, with the 
smaller drill stopping at the cavity edge and allowing the 120-degree cone 
angle of the holes to produce a pronounced feathered edge. 


Solution: 

The problem shown can be alleviated either by drilling through or by 
stopping short of the original position, as illustrated by figures 8b 
and 8c. During design, it is a simple task to find potential feathered 
edges. All intersecting drills should be examined for feathered edges. 





Figure 8.- Component housings - Sharp feathered edges. 
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Burr Removal 


Problem: 

Small attached splinters of metal created during machining are called 
burrs (fig. 9). These burrs are usually removed during manufacturing; 
however, if the burr is in an inaccessible passage, it may not be detected. 
The problem is that the burr (much like the feathered edge just discussed) 
is a thin piece of metal with little mass and large area which can by 
localized heat generation easily become an ignition point or a source of 
fuel. The burr also has impact potential because it could be dislodged 
during operation. It is a fixed contaminant which cannot be flushed 
away or even detected with certainty. 


Solution: 

Detection and correction must come early in the design cycle. When a pos- 
sible burr location is identified, the area should be redesigned. If it 
is not possible to eliminate the condition, then special inspection tools 
such as borescopes should be specified and deburring procedures developed. 

Burrs and sharp edges are so critical in high pressure oxygen systems that 
their removal should be emphasized during the design phase by specific 
drawing callouts to every edge and corner that will be exposed to the flow 
stream. In addition, specific inspection procedures should be defined by 
procedural document also called out on individual drawings. Such emphasis 
is necessary since burr removal on most other hardware is usually called 
for by general note, poorly considered in design, often neglected in manu- 
facturing, and ignored in inspection. This has been found by spot inspec- 
tion to be the case even in crucial high pressure oxygen systems when such 
emphasis was not made. 

Burr removal in small diameter internal passageways at the intersection of 
cross drills has been one of the most difficult techniques to develop. 

Best results have been obtained with small motorized grinding tools and 
with electrical discharge machining (EDM). 



Figure 9.- Component housings - Burr Removal. 


4-6 



Flow Impingement on Aluminum Housings 
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Problem: 

Since aluminum constitutes a fuel in an oxygen fire and since the oxygen* 
flow might contain particulate matter that could ignite this fuel on im- 
pact, the flow should not be allowed to impinge directly on an aluminum 
housing wall (figure 10a). 


Solution: 

The housings of newly manufactured hardware should be made of fire- 
resistant material such as Monel or some other high-nickel alloy. To cor- 
rect for impingement in existing hardware, critical areas of high pressure 
and high flow can be shielded with fire-resistant metals. Rerouting and 
diffusing flow can also slow or block impacting particles (figure 10b). 



Figure 10.- Conponent housings - Flow impingement on aluminum housings. 
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VALVES 


Conventional valve parts are designed to preclude galling and to 
withstand the high stresses of elevated pressure and spring forces. Monel 
alloys are fire-resistant and the range of hardnesses in which they are - 
produced can be used to minimi 2 e galling problems. The harder, stronger 
alloys such as K-Monel can be used for highly stressed, small diameter, 
moving parts such as valve stems. 400-series Monel can then be used for 
the valve body. Springs can be wound from Monel wire. Miniature springs 
can be made of Elgiloy or beryllium copper if small diameter Monel wire is 
not available. Tungsten carbide and steel poppet balls should be replaced 
with sapphire balls since sapphire has a lower level of reactivity (and 
therefore is less combustible) than either tungsten carbide or steel. It 
is also more resistant than tungsten carbide to breakup under a mechanical 
impact in oxygen. Lock rings and retainer nuts that are not exposed to ox- 
ygen can still be made of lightweight aluminum since they are not subject 
to the oxygen ignition hazard (although galvanic corrosion of dissimilar 
metals must still be considered). 

The working parts, if made of combustible materials, can contribute 
significant mass to fuel a fire. Friction between moving parts can initi- 
ate combustion within the valve. Static or impact loads on subminiature, 
highly stressed parts can cause fracture or heating of these parts, which 
can then initiate combustion. Flow-induced oscillation or chattering of 
a poppet within a valve can result in fretting and highly localized heat 
generation, which can lead to ignition. 

Volumes upstream of a valve may be affected by high valve actuation 
rates. The fast closing of the valve could produce a water hammer effect, 
sending a pressure pulse upstream, which could then cause a temperature 
rise by adiabatic compression. Such a pulse could also cause structural 
failure in an upstream component or container. 

Volumes downstream of a valve may also be affected by high valve 
actuation rates. The fast opening of the valve could subject passageways 
or components to adiabatic compression, which could result in hot spots 
and possible ignition of nonmetallics or particulate contaminants. 

These problems and suggested solutions are presented in the following 
valve design articles. 
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static and Impact Loads on Subminiature Parts 
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Problem: 

Valves for high pressure oxygen systems may be designed with subminiature 
parts to reduce pressure forces so that regulating springs can be kept a 
reasonable size. If these parts get too small, then they may be highly 
stressed by the ordinary static and impact loads. If the high stresses 
are applied quickly, the local energy transfer rates can be high enough to 
fracture a miniature part or heat it enough to ignite it or any contami- 
nant present (fig. 11). 


Solution; 

High pressure oxygen systems should be designed so that working loads on 
valves with subminiature parts are Iw. Fast actuation which could apply 
impact loads to such subminiature parts should be avoided, and the parts 
should be made of materials that are not impact sensitive. Furthermore, 
each system should be designed for cleanliness and isolation of contami- 
nants. 



Figure 11.- Valves - Static and impact loads on subminiature parts. 
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Check Valve Chatter 
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Problem: 

Under some flow rate conditions, check valves in oxygen service may 
"chatter" as a result of a resonant coupling of the dynamically induced 
flow forces (which are dependent on check valve geometry, system geometry, 
flow rate, and oxygen pressure and temperature) with the check valve seat- 
ing spring forces. Chattering results in the poppet’s hitting the seat at 
a high frequency and can cause an ignition at the seat due to the high 
localized heat generation. Furthermore, the chattering can generate par- 
ticulate matter which can inhibit the function of downstream components 
or act as a fuel for ignition farther downstream. 


Solution: 

Check valves are available in a broad variety of configurations. Figure 
12 shows the cross-section of a typical check valve. Successful check 
valve design includes selection of appropriate materials; selection of 
tolerances to avoid galling of moving parts; and control of tolerances 
to avoid lateral instability (chatter) of the poppet in its guide. To 
control axial chatter, a variety of techniques are available. The use 
of a soft-seating spring can minimize cracking pressure so that only a 
minimal flow holds the valve open. Or the valve may be designed so that 
the poppet must move substantially off its seat before the flow ports 
are uncovered. 

Close attention should be given to dynamic analysis of the check valve de- 
sign across its entire flow range and for the entire spectrum of expected 
oxygen temperatures and pressures to show its dynamic stability. Because 
of the difficulty of such analyses, the valve must be also tested as a com- 
ponent and in a complete system configuration (see section 7). 





Poppet Oscniation (AsymmetricaT Flow) 
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Problem: 

4 

Asymuetric flow across a valve poppet creates a dynamic imbalance of flow 
forces on the poppet, causing it to oscillate transversely against its 
bore. This transverse oscillation results in the poppet's hitting the 
bore at a high frequency and can cause an ignition due to the high local- 
ized heat generation. Furthermore, the transverse oscillation can generate 
particulate matter which can inhibit the function of downstream components 
or act as a fuel for ignition farther downstream, figure 13a. 


Solution: 


Where possible, the internal flow geometry within valves should provide 
symmetrical flow across the poppet. An effective alternate approach is to 
mount the poppet in the bore by means of flexure assemblies, which are 
very flexible in the longitudinal direction (and thus do not inhibit the 
valve's open/close action) but which restrict the transverse motion of the 
poppet. The flexure assemblies act to center the poppet in the bore at 
all times and thus prevent any transverse contact. Bore and poppet mate- 
rials should be selected to minimize the possibility of ignition. Both 
surfaces may be metal lurgically hardened to minimize deterioration due to 
fretting, figure 13b. 




Figure 13.- Valves - Poppet Oscillation, 
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Actuation Rates 


Problem: 

Actuation of a fast-opening shutoff valve subjects the first stage regula- 
tor and passageways immediately upstream of the regulator to a sudden in- 
crease in pressure as shown schematically in figure 14a. This sudden pres 
sure rise can cause adiabatic compression resulting in localized tempera- 
tures high enough to ignite nonmetallic seals or particulate contamina- 
tion. 

Fast closing allows bottle pressures to put high impact loads on the valve 
seat. Energy transferred in the impact can ignite contamination on the 
seat. 


Solution: 

The system requirements should be evaluated with the goal of establishing 
as slow an actuation rate as feasible. Once the minimum actuation rate re- 
quirement is established, the actuating valve can be designed specifically 
to achieve this rate. Orifices or restrictions may be required to limit 
pressurization rates. For components already existing, thermodynamic anal- 
ysis techniques should be used to identify areas of concern. The rate can 
then be decreased by converting a fast-working pushbutton actuator to a 
slower threaded-type actuator. 

Another method, shown schematically in figure 14b, is to Incorporate the 
shutoff function into a regulator stage using the regulator valve as the 
shutoff seal. No separate shutoff valve is then required. Before the reg- 
ulator is actuated, the first stage is closed with high pressure upstream 
of the valve seat and medium pressure downstream. The second stage is 
also closed with medium pressure upstream of its valve seat and no pres- 
sure downstream. After the regulator is actuated, downstream pressure in- 
creases over a relatively small differential. No sudden increases occur, 
so no heat -producing compression takes place. This method of decreasing 
the actuation rate is useful even when long term storage is a factor. If 
the first stage slowly leaks, it may in time increase the interstage pres- 
sure to the level of the supply pressure (7400 Ib/in^ or 51 MN/m^ in the 
illustration). When the second stage regulator (functioning also as a 
shutoff valve) is opened, there will be a surge of flow. But the regula- 
tor will quickly close again since its desired downstream pressure will be 
immediately reached. If the- interstage volume is small - and it should be 
small by design - then there will not be much oxygen to support a sus- 
tained surge. 

The definitions of "fast" and "slow" depend on the situation. Factors that 
should be considered in establishing actuation rates include the ignition 
temperatures of the nonmetallics and metal! ics downstream of the valve, the 
total volume immediately downstream of the valve, the operating temperature, 
the operating pressure, the pressure rise rates in volumes downstream of 
the valve, and the heat transfer characteristics of the oxygen and the pas- 
sageway walls. Since all these factors will vary from system to system. 
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it is difficult to establish valving rates or pressure rise rates that 
would be acceptable for each case. But extensive pneumatic impact testing 
with oxygen has indicated that an actuation rate of 50 milliseconds or 
less to bring downstream pressure to 95 percent of upstream pressure does 
routinely cause ignition. This rate and any faster rate should definitely 
be considered "fast." Ball valves are very fast; their actuation rate has 
been measured at less than 2 milliseconds. At the other extreme, a rate 
of 0.5 second to achieve the same downstream-to-upstream pressure ratio 
has been found to cause no ignitions in extensive testing up to 2000 
lb/in2 (14 MN/m^). This rate and any slower should be acceptably "slow" 
from the standpoint of adiabatic compression ignition. 


There may be a limit, however, to the "slowness" that should be designed 
into a particular system. If a valve opens too slowly, it presents in ef- 
fect a slowly expanding orifice to the flow stream. If the upstream and 
downstream pressures and orifice characteristics are such that the flow 
becomes supersonic, then particulate contamination may be accelerated to 
a high velocity. Such a velocity can be much higher than would be experi- 
enced in a "fast" opening (and slower flowing) valve. With the Increased 
kinetic energy, particle impacts are more capable of causing ignition. 
Evidence of this phenomenon exists in oxygen test program experience. To 
determine the best trade-off, a thorough analysis of the actuation, con- 


sidering all the factors listed above, 
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Single Barrier Failure 
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Problem: 

A leak in which only the primary containment structure is breached is 
defined as a single barrier failure. Such a leak Introduces oxygen into 
a region which is not normally exposed to oxygen. In this region, the ma- 
terials or configuration of parts may not be compatible with high pressure 
oxygen. In the pressure transducer shown In figure 15, rupture of the 
bourdon tube would constitute a single barrier failure since oxygen would 
leak into the surrounding cavity. 


quality 


Solution: 

Any situation in which there is a single barrier that may fail should be 
analyzed during the design phase. Such single barrier failure analysis 
can consist of an engineering evaluation of the configuration, including 
analysis of materials, or a configuration test may be performed. In the 
case of the pressure transducer shown below, a configuration test was 
performed by drilling a hole in the bourdon tube, then pressurizing it 
with oxygen. A spark from the resistance wiper arm caused ignition and 
the resulting explosion destroyed the transducer. The configuration was 
subsequently changed by adding an oxygen-compatible oil to the cavity to 
prevent sparking. 


Resistance wiper arm< 
■Pressure sensing 



Hoie drilled for 
configuration test 


Bourdon tube 


Figure 15.- Valves - Single barrier failure. 
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Rotating Stem Valves 
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Problem; 

A manual, screw-type valve with a rotating stem, figure 16a, might seem de- 
sirable in a high pressure oxygen system because such a valve can provide 
a slow actuation rate. However, a rotating stem valve presents contamina- 
tion problems especially when coirt)ined with a nonmetallic seat. Such a 
seat can easily be damaged by excessive closing torque or by shredding or 
gas erosion during both opening and closing. Furthermore, solid contami- 
nants can become embedded in such soft seat material. If the seat is made 
of metal, it must be hardened to prevent galling by the rotating stem. Such 
hardened materials can fracture or even fragment as a result of excessive 
closing torque or closure onto hard contaminants (like silicon dioxide). 
Also, seat galling is still possible when the valve stem rotates against 
a metallic seat. 


Solution: 

A manual valve with a nonrotating stem, figure 16b, and a metallic seat 
can be chosen to achieve the desired slow actuation rate. In this case, 
the metal seat can be made of a much softer material and the seat can be 
formed by "coining" (pressure molding by the stem itself to create a per- 
fect match). Contaminants will not cause fragmentation of such a seat. 
Galling cannot occur unless the nonrotating feature is compromised. The 
seat and body of such a valve can be fabricated from such metals as 
Inconel or Monel, which have been shown to be comparatively unreactive 
with oxygen. 




Figure 16.- Valves - Rotation stem valves. 
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SEALS 


Seals used in valves and fittings are made of relatively soft non- 
metallic materials. All such materials with adequate mechanical proper- 
ties are ignitable at relatively low temperatures compared to the ignition 
temperatures of the surrounding metal parts. Seal locations are therefore 
among the most likely combustion sites. To decrease the risk created by 
these locations, the nunfcer of seals used should be minimized. Where they 
are used, they should be shielded or removed from the flow stream. 

The following articles discuss not only some techniques of shielding 
seals from flow impingement but also some methods of avoiding such seal- 
eroding conditions as alternating pressure, seal extrusion, seal squeeze, 
seal rotation, and the effects of poor seat shape. Also presented are 
some considerations on using dynamic seals and metal -to-metal rubbing 
seals. 
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Flow Impingement 
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Problem: 

If the oxygen flow stream impinges directly on an exposed nonmetal lie of ' 
low ignition temperature such as 0-ring material, there is a risk of igni- 
tion due to impact by contaminants carried along in the flow stream 
(figure 17a). 


Solution: 

This problem can be solved by shielding the 0-ring from the flow stream 
with a backup ring of a material with a higher ignition temperature or by 
designing the housing bore and sealed component so that metal is bottomed 
on metal, creating a flow barrier to protect the 0-ring (figures 17b and 
17c). 
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Figure 17.- Seals - Flow impingement. 
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Alternating Pressure (Redundant Seal) 
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Problem: 

When two sets of seals are used at the same location in a long term pres- 
surized storage application, eventual permeation of the first seal pro- 
duces a pressurized volume between the seals. The pressure in this zone 
would be greater than that on the low pressure side of the component but 
less than operating pressure. When the valve is opened and the low pres- 
sure side Is raised to operating pressure, the second seal is exposed to 
pressure on Its downstream side which is now greater than that in the 
intermediate zone. As the component goes through several use cycles, the 
direction of the pressure force alternates from one side to the other. 
This alternating pressure can cause seal working and erosion or blowback 
of contaminants (figure 18a). 


Solution: 

The solution is to eliminate the second "redundant" set of seals and 
ensure that the first set of seals is adequate in oxygen compatibility. 
Shore hardness, and proper use of backup rings to perform the sealing 
task alone (figure 18b). 
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Figure 18.- Seals - Alternating pressure (redundant seal). 
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Seal Extrusion (Backup Rings) 
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Problem: 

In high pressure oxygen systems, it is critical to minimize both seal ero- 
sion and contaminant generation. Without backup rings, 0-rings can be par 
tially extruded into the radial gap between parts. Even though the 0-ring 
may still seal, such extrusion over a number of cycles may wear off mate- 
rial, thus degrading the seal and contaminating the system with nonmetal- 
lic particulates. In systems with very high pressures, ordinary backup 
rings may also be partially extruded, causing the same problems (figures 
19a and 19c). 


Solution: 


For safety in high pressure oxygen systems, one should use backup rings on 
the low pressure side of 0-rings even at pressures where standard 0-ring 
practice does not dictate such use for gases in general. At pressures 
greater than 1000 lb/in2 (7 MN/ro^), more sophisticated backup ring shapes 
such as delta rings should be used (figures 19b and 19d). 

t 
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Figure 19.- Seals - Seal extrusion (backup rings). 
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Seal Squeeze 
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Problem: 

Buildup of tolerances on valve parts or an unfavorable configuration in 
which to machine a gland may result in a gland too small for its 0-ring 
seal. Since a certain amount of compression or squeeze in the axial di- 
rection is necessary to achieve the proper sealing load, there must be 
space for the 0-ring to expand radially. If this radial space cannot be 
provided, the 0-ring will be partially extruded from the gland and this 
extrusion will result in particualte pieces being shaved off. 


Solution: 

Careful attention should be given to dimensions and tolerances of all 
parts in the valve assembly. Ideally, adequate gland size should be pro- 
vided in the initial design. When adequate gland size cannot be achieved, 
a special seal with an oval cross section may be used. This seal retains 
the required dimension axially but has a reduced cross-sectional width. 
Thus, the seal will occupy less space side to side even when compressed 
(fig. 20). 
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Figure 20.- Seals - Seal squeeze. 
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Rotation of Seals 
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Problem: 

Sealed parts that require rotation at assembly (such as 0-rings on 
threaded shafts) can generate particles which may migrate into the flow 
stream as shown in the first illustration. Particulate generation also 
occurs in ball valves where operation of the valve rotates a ball on a 
nonmetal lie seat. 

A related phenomenon which may be described as "feathering" occurs when 
valve stems are rotated against some nontnetallic seats such as KEL-F. Be- 
cause of the mechanical properties of some nonmetallics, a thin, feather- 
like projection of material is extruded from the seat. The feathered fea- 
ture is more ignitable than the seat itself would have been (figure 21a). 


Solution: 

Instead of a rotating sealed part, the sealed part could be designed as 
a push-in plug locked in place by a second part which is threaded but not 
sealed as shown in figure 21b. Alternately the sealed threads could be 
replaced with a flanged and bolted connection. Kel-F seals should not be 
used in rotating configurations at all and ball valves are not recommended for 
for oxygen systems not only because of particle generation but also because 
of fast actuation rates. 


Threads require 
rotation of seal 



Threads removed 
seal not rotated 
at assembly 



(b) 


Figure 21.- Seals - Rotation of seals. 
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Seat Shape 


ORlGtuAL Pi^2 F3 
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Problem: 

Designs which seal an 0-ring on an unusual seat shape may set the stage 
for increased wear problems or unduly accelerated extrusion of the non- 
metallic. Such effects can generate particulate contamination which will 
increase the risk of combustion. An example of such a design is seen in 
figure 22a wherein a face-type 0-ring seal is seated on the edge of the 
sealing surface. 


Solution: 

Nonmetal lie sealing interfaces are a necessary compromise; however, the 
designs can be optimized. The example is objectionable because it uti- 
lizes an 0-ring in^iroperly. The most reliable valve and regulator con- 
figurations have been found to be a metallic or sapphire ball in a 
washer-shaped Vespel seat, as shown in figure 22b. 


0-ring seated 



Washer-shaped 
seat — I 



(b) L_Ball 


Figure 22.- Seals - Seat shape. 
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Dynamic Seals 


on!(Si:p- p-G:: :s 

OF POOR QUALITY 


Problem: 

4 

When a portion of a valve or fitting moves in relation to a sealing sur- 
face, friction can generate particles at the interface. The amount of 
particulate matter depends on the load and coefficient of friction between 
the metallic part and the nonmetal lie seal and on the strength of the 
nonmetallic seal material. Unfortunately, even the best nonmetallic mate- 
rials for 0-rings in high pressure oxygen service have a fairly substan- 
tial friction coefficient and a relatively low strength (figure 23a). 


Solution: 

For applications up to about 1200 Ib/in^ (8.3 MN/m^), the 0-ring may be 
replaced by a spring-loaded Teflon seal. The Teflon has both a lower coef- 
ficient of friction and a higher strength. Such seals may require modifi- 
cation of the seal groove in radial seal applications since they cannot be 
stretched as much as elastomeric 0-r1ngs for assembly. Spring-loaded 
Teflon seals may not be adequate for use as rotating shaft seals or other 
continuous-motion applications since frictional heat buildup becomes a 
problem. In such applications, special configurations may be required to 
provide heat rejection. 

For valves and fittings used at pressures above 1200 Ib/in^ (8.3 MN/m^), 
seals made of pure Teflon (PTFE) may be acceptable if the reduced sealing 
capability due to cold flow can be tolerated. Also, batch-certified Viton 
or KEL-F 81 may be used, although Viton may harden and permit leakage at 
temperatures of -40° F (23 K) and lower (figure 23b). 



(a) 




Metal -to -Metal Rubbing Seals 


Problem: 

Design requirements for valves that control the flow of hot oxygen at high 
pressure rule out soft seals. In this situation, soft seals are replaced 
by metal -to -metal rubbing seals. High pressure and high flow rates can 
produce side loads and oscillations on the poppet seal; these side loads 
and oscillations can cause fretting or galling. Fretting, in this case, 
means metal deterioration caused by repetitive high frequency vibration at 
the interface between two surfaces. Galling is a more severe condition 
involving smearing and transfer of material from one surface to the other. 
Both occurrences are problems in oxygen systems. The valve poppet could 
seize, resulting in loss of function; the frictional heat of the fretting 
or galling could lead to ignition of the valve; or the particles generated 
by the fretting or galling could cause malfunction or ignition of another 
component downstream, figure 24a. 


Solution: 

Where possible, the valve poppet should be designed for symmetrical flow 
so that no oscillatory side loads are created. The symmetrical flow will 
center the poppet in the bore and maintain design clearances between the 
poppet and bore surfaces. 

For gaseous systems it may be possible to reduce the volumetric flow rate 
(and thus the magnitude of oscillations and side loads) by installing an 
orifice downstream of the poppet to minimize the pressure differential 
occurring across the poppet. 

It is also possible to flexure mount the poppet in the bore and to in- 
crease the clearance between the poppet and the bore by incorporating laby 
rinth seal grooves in the poppet surface. 

Poppet and bore materials should be selected to minimize the chance of ig- 
nition. Both may be hardened by a process like nitriding to minimize mate 
rial loss due to fretting or galling, figure 24b. 
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Rubbing surface 




FILTERS 


Contamination can never be con^letely eliminated from a fluid system 
since it is always being generated to some degree by moving parts. It is 
therefore usually necessary to control and remove particulates from the 
flow stream continuously. Filters are the devices most commonly used to 
control particulates. While they do trap most contaminants above a spe- 
cific size, there are concerns associated with their use. One is that 
after some use the filter becomes a potential combustion site just because 
of the high combustibility of its collection of fine particles. Another 
concern is that filters are made of very small diameter metallic wire, so 
small that a very slight addition of heat can cause hot spots in the wire. 

Proper design of filters must include a careful trade-off study to 
ensure that ignition potential is reduced rather than increased. Use of 
fire-resistant materials such as pure nickel or Monel can ease some of the 
concern. A maintenance plan that calls for frequent cleaning or replace- 
ment of filters can also help. 

Other techniques are discussed in the following articles on the use 
of filters at the inlets and outlets of modules, upstream of valve seats, 
and around diff icult-to-clean passageways. 



Filters at Inlets and Outlets of Modules 
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Problem: 

Modular pressure system components, such as regulator assemblies, which' 
are manufactured, tested, shipped, and handled as independent units, are 
subject to the introduction of contaminants through their inlet and outlet 
ports. These ports are sealed off by fittings and tubes during normal 
operation, but these openings may be unprotected before the module is 
installed in the system. 


Solution; 

Install at inlet and outlet ports filters that remain in place whether 
connecting fittings are in or out. The typical installation is shown 
in figure 25. 



Figure 25.- Filters - Filters at inlets and outlets of modules. 
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Filters Upstream of Valve Seats 
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Problem: 

Valve seats In high pressure oxygen systems are critical sealing points 
which must be carefully designed and manufactured to provide leakproof, 
reliable pressure control. Proper material selection and seat -forming 
techniques are crucial if an adequate seal is to be achieved for long 
term storage at high pressure and for thousands of cycles of use. The 
performance of such a seal is degraded by the trapping of contaminant 
particles at its sealing interface (figure 26a). 


Solution: 

Install very fine mesh (e.g., 10-micron) filters immediately upstream of 
valve seats (figure 26b). 



Figure 26.- Filters - Filters upstream of valve seats. 
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Filters Isolating Unavoidably "Dirty'' Passageways 
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Problem: 

« 

Some portions of the flow stream in an oxygen system may be extremely dif- 
ficult to clean during manufacturing. The pressure bottle shown in figure 
27a has tubing brazed to the inside of the wall which is difficult to 
clean adequately. The long passagew^ with a small diameter, shown in 
figure 27b, could not be satisfactorily cleaned once the plug was welded 
in place. Welds and soldered and brazed joints, if left in the as-formed 
condition, may leave slag, roughness, porosity, or cracks which can gener- 
ate or trap contaminants. 


Solution: 

Fine mesh filters should be added immediately outside the unavoidably 
"dirty" passageways to contain and control contamination that cannot be 
eliminated. Welds should be specified as full penetration so that all 
contacting surface area is joined together to prevent entrapment of par- 
ticulates and eliminate uncleanable blind surfaces. Exposed weld sur- 
faces should then be ground to a smooth finish to enhance cleaning. 


Tubing brazed 




Figure 27.- Filters - Filters isolating unavoidably "Dirty" passageways. 
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ANCILLARY EQUIPMENT 


In addition to housings, valves, seals, and filters, high pressure 
oxygen systems typically contain a varied collection of ancillary compo- 
nents such as tanks, pumps, heaters, and sensors. These components 
should be designed just as carefully as the other components we have 
discussed. They have their own unique set of design considerations. 

Tanks for high pressure oxygen systems, for instance, may not be made 
of titanium an^ Its alloys despite the high strength-to-weighi r~al1os 
which normally mal<e them so attractive. Titanium and its alloys are~im- 
pact sensitive in oxygen atmospheresT 

Pumps, compressors, fans, and blowers in oxygen service must be care- 
fully designed to avoid rotational friction, or rubbing, which can quickly 
lead to an ignition. Bootstrap pumps, in which a fuel-rich gas drives a 
turbine on a common shaft with the oxygen pump, present the special prob- 
lem of avoiding fluid contact along the common shaft. 

Heaters and sensors in oxygen systems present a special set of prob- 
lems because they introduce electrical current into an environment where 
a short circuit or an arc would cause an Ignition. 

The following pages discuss some of the design problems and solutions 
related to ancillary components. 


Bootstrap Oxygen Turbopunp 
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Problem: 

Bootstrap oxygen turbopumps, such as are employed in boost propulsion* 
systems, utilize hot fuel-rich combustion gases to drive a turbine which 
also drives the oxygen turbopump on the common shaft. Mixing along the 
common shaft of the fuel-rich combustion gases with the high pressure 
oxygen being pumped will produce high temperature combustion that will 
destroy the turbopump. 


Solution: 

Use of an additional, intermediate set of seals along the shaft creates 
a separation area which is then continuously purged with an inert gas to 
avoid the development of a hazardous gas mixture (fig. 28). 


Inert gas 



Figure 28.- Ancillary equipment - Bootstrap oxygen turbopump. 
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Heaters 


ORIGINAL 


Problem: 

In certain cases heaters are required to function within the high pressure 
oxygen environment. A malfunction in the heater or its control circuitry 
could result in overheating, a short circuit, or arcing, which would ig- 
nite system materials. 


Solution: 

Heater temperatures should be controlled to values substantially below the 
temperature at which ignition of the heater surface material or any adja- 
cent material could occur. This margin should be at least 200° F (111 K). 
In establishing it, the designer should consider the possible temperature 
difference between the thermal sensor and the hottest heater surface loca- 
tion, the uncertainty in sensor reading, and the uncertainty in ignition 
temperature. Redundant thermal sensors should be used if indicated by a 
failure modes and effects analysis. 

Ignition due to electrical malfunction of the heater may be prevented by 
using double-insulated heater wire. An additional safety feature that can 
be used is the differential current sensor, which monitors heater current 
in both the inlet and the outlet wire and turns the heater power off if a 
predetermined imbalance develops (such as from a short or an arc from the 
heater to another element in the system). Materials, both metallic and 
nonmetallic, should be chosen to minimize the chance of ignition should a 
short or arc occur. 


.Differential current sensor 
Signal conditioner / 



Figure 29.- Ancillary equipment - Heaters. 
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Sensors 


Problem; 

Sensors are required in oxygen systems to measure such parameters as tem- 
perature, pressure, density, liquid level, and flow rate. A malfunction 
in the sensor or its signal conditioner could result in high current flow, 
overheating, a short circuit, or arcing, which should ignite system 
materials. 


Solution: 

Sensor and signal conditioner circuitry should be designed to minimize the 
current flow and thus the overheating and arcing that might result from a 
short in the sensor system. Materials, both metallic and nonmetallic, 
should be chosen to minimize the chance of ignition should a short occur. 
In situations where arcing can occur, testing should verify that the 
maximum possible spark energy is insufficient to cause ignition of adja- 
cent materials. 

No figure is used to illustrate this item. 
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5. SYSTEMS DESIGN 


It is our purpose in this section of the handbook to build on the 
guidelines for material selection and component design given in sections 
3 and 4 and to extend these guidelines to the systems design level. These 
added guidelines are not exhaustive but focus on those special considera- 
tions required in the design of an oxygen system. 

It is assumed that the designer will adequately handle those standard 
analyses related to system flow capacity, dynamic and static structural 
loads, thermally induced loads, heat transfer, etc. These routine anal- 
yses are not unique to high pressure oxygen systems, but inadequate atten- 
tion to them can result in system failures whose results are magnified be- 
cause of the extreme reactivity of oxygen. 

Many of the special analyses required in the design of oxygen sys- 
tems, as well as many of the potential design problems and the design prac- 
tices for overcoming them that were presented in section 4 at the component 
level also apply at the system level. These areas have already been ade- 
quately discussed in section 4 and the information will not be repeated 
here. 


Two areas of importance in the design of high pressure oxygen systems 
that should be noted are as follows: 

1. In the performance of the fracture mechanics and flaw growth anal- 
yses, which should be a part of any system design, the designer should be 
aware that the presence of oxygen increases the fatigue crack growth rate 
in metals as compared to the rate in an inert atmosphere. Also, in gas- 
eous oxygen systems, the presence of water vapor can further accelerate 
fatigue crack growth. 

2. The selected architecture of high pressure oxygen systems imposes 
certain constraints on system operations such as the sequence and timing 
of commanded component functions. As an example, during shutdown of a 
cryogenic boost propulsion system, the engine's liquid oxygen prevalves 
must be closed and the LO? inlet line to the oxygen turbopump pressurized 
with inert gas within a closely specified time to avoid cavitation and 

a dangerous overspeed condition in the liquid oxygen turbopump. As part 
of the standard failure modes and effects analyses (FMEA) a comprehensive 
system operating analysis should be performed to understand the con- 
straints imposed by a particular architecture on both normal and failure- 
mode operations. 

In this section, we present design considerations for the use of high 
pressure oxygen which require special attention at the system level. We 
have grouped these design guidelines and special considerations into the 
following categories for discussion: 

System architecture 

System flow dynamics 

System thermal design 

System cleanliness 
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We will distinguish between cryogenic liquid, supercritical, and gaseous 
oxygen systems when the distinction is important. 


SYSTEM ARCHITECTURE 

System architecture considerations include identifying the components 
required to perform the function, defining redundancy requirements, and 
locating components within the vehicle and in relation to one another. 
Failure modes and effects analysis (FMEA) is an effective tool in the ini- 
tial process of designing system architecture and should be used in select 
ing components, establishing redundancy levels, and evaluating specific 
system geometries, rather than as an after-the-fact justification of a sys 
tern architecture that was derived by less disciplined means. There are 
system geometry considerations related to flow dynamics, thermal design, 
and cleanliness which will be discussed subsequently under those headings. 
The following two items are important system architecture considerations 
for oxygen systems. 


Protection of System Redundancy 


Problem: 

A component or system-level failure can initiate a fire within the system. 
Oxygen fires, once started, spread rapidly using any exposed nonmetallics 
and even some metals as fuel. The fire may not only engulf the affected 
components but also spread to adjacent components and destroy system 
redundancy. 


Solution; 

Containment of a fire to as small an area as possible is desired. If the 
fire can be limited to a single component or to a small area, redundant 
components should be able to carry on the system function. Not only 
should all system materials be selected with an eye to their combustibil- 
ity, but, wherever practicable, they should be selected to provide fire- 
breaks between system components. Nickel and Monel are candidate fire- 
resistant materials. Furthermore, redundant system components should not 
be located in a common assembly or adjacent to one another because the 
failure of one of the components could then lead to failure of the others. 
The redundant components should be separated geometrically and also by 
firebreaks vdierever possible. Figure 30 Illustrates the use of firebreak 
application In systems architecture. 
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Figure 30.- System architecture - Protection of system redundancy. 


Location of Oxygen System Relief Ports 


Problem; 

All high pressure oxygen systems are provided with pressure relief ports 
to prevent structural failure due to overpressure. Improperly located 
oxygen vents can damage adjacent components or cause an ignition. 


Solution: 

The designer must evaluate all system relief port locations to ensure that 
oxygen will not be vented overboard near a fuel or internally into an area 
containing a fuel and an Ignition source. If oxygen Is vented Into inter- 
nal vehicle cavities, a cavity analysis should be done to verify that no 
hazardous situation will develop as a result of the vent. As part of the 
system-level FMEA, a similar compartment hazard analysis should be done 
to determine the effects of any system leaks. Where cryogenic oxygen is 
vented, the potential to freeze adjacent components of other systems 
should be evaluated. 

No figure is used to illustrate this item. 
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SYSTEM FLOW DYNAMICS 


Considerations of system flow dynamics include flow velocity effects, 
particle impact, erosion, cavitation, induced vibration, geysering, water 
hammer, and pressure spikes. Particle impact effects, water hammer, and' 
adiabatic compression effects have been discussed in section 4. The fol- 
lowing four items deal with aspects of flow dynamics as they affect oxygen 
systems . 

Because of the complexity and the variability of system design, no at 
tempt was made to illustrate the items discussed in the rest of this sec- 
tion. We believe the problem statement and solutions are adequate for 
clear understanding. 


System Erosion 


Problem: 

Erosion of system components due to flow phenomena such as particle 
impacts, impacts of droplets entrained in a gas flow, and cavitation can 
expose fresh, reactive surfaces to oxygen and provide the localized heat 
generation necessary to cause ignition. 


Solution: 

Good design practice to prevent erosion, as in the case of particle im- 
pact, includes velocity control, a flow geometry that minimizes impact 
angle, adequate filtration, selection of ignition-resistant materials, and 
control of localized system pressure drop and heat input to minimize cavi- 
tation potential. 


Cavitation in Rotating Equipment 


Problem: 

Cavitation (creation of localized areas in the fluid having pressures be- 
low the vapor pressure) in liquid oxygen feed systems upstream of oxygen 
turbopumps can result in a variety of turbopump hazards. These hazards in 
elude erosion of the impeller and localized burning of the impeller due to 
bubble collapse. Extensive cavitation may cause turbopump overspeed lead- 
ing to critical rotor dynamics problems, including rubbing of the impeller 
on the housing with resultant frictional ignition. 


Solution: 

The system design must provide adequate net positive suction pressure 
(NPSP) to oxygen turbopumps by establishing adequate supply tank pressure 
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and carefully calculating and controlling flow system thermal inputs or by 
using a boost pump upstream of the turbopump. 


Flow-Induced Vibration In Bellows and Flexible Joints 


Problem: 

Oxygen flow through bellows and flexible joints can induce high-level pres- 
sure fluctuations in these components which can lead to rapid failure due 
to structural fatigue. 


Solution: 

Flow velocity through these components should be minimized. Where possi- 
ble, bellows should be lined. Where lined bellows cannot be used, the 
system should be analyzed for susceptibility to flow-induced vibration. 


Geyserinq in Cryogenic Liquid Oxygen Propulsion Feed Systems 


Problem: 

Geysering occurs in vertical systems with a tank and a long feed line from 
it filled with cryogenic oxygen. Heat transfer into the line causes gas 
bubbles to form and begin rising in the line. As the bubbles rise, they 
coalesce to form larger bubbles. In a line that is long with respect to 
its diameter, the result is an expanding vapor bubble of sufficient size 
to expel the liquid above it into the tank with a force large enough at 
times to rupture the tank or to damage internal tank components such as 
baffles, screens, or level sensors. When the liquid subsequently reenters 
the line, it can cause large water hammer forces with accompanying system 
damage . 


Solution: 

Geysering can be controlled by controlling tank pressure, choosing appro- 
priate feedline geometry, insulating the feedline, and recirculating the 
fluid from the low point in the line back to the tank. Control consists 
of keeping the oxygen in the line from reaching its vaporization tempera- 
ture and providing adequate line diameter to handle the vapor bubble perco 
lation that still occurs. 
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SYSTEM THERMAL DESIGN 


System thermal design considerations include startup thermal con- 
ditioning, insulating to prevent external system condensation, and avoid- 
ing the lockup of cryogenic oxygen in a system segment. 


Startup Malfunctions in Rotating Equipment and Dynamic System Components 


Problem; 

In cryogenic oxygen turbopump systems, it is necessary to bring compo- 
nents to thermal equilibrium before starting up the system to avoid 
hazardous component thermal transients which may affect fits and clear- 
ances, cause rotor dynamic instabilities, or lead to high speed rubbing 
friction. Any of these problems may result in an ignition. 


Solution: 

Provide thermal conditioning of the cryogenic system and components by 
gradually bleeding through cryogenic gas, then liquid. Once approximate 
thermal equilibrium is achieved, maintain it by using pumps to circulate 
properly conditioned fluid through the system before startup. 


Condensation on External System Surfaces 


Problem: 

Exposed cryogenic surfaces in oxygen systems can form large amounts of 
Ice. The falling ice can damage the vehicle or its components during 
ground operations or launch. 


Solution: 

Exposed cryogenic surfaces should be insulated. Any of the various insula- 
tion schemes (sprayed-on foam, wrap-around closed-cell segments, vacuum 
jackets) used to control heat input to cryogenic oxygen systems can be 
used to preclude the formation of ice or liquid air on surfaces. The de- 
signer should ensure that there are no uninsulated system areas or exposed 
gaps between insulated areas which permit the buildup of ice. 
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Lockup of Cryogenic Oxygen in System Segments 


Problem: 

Cryogenic oxygen hydraulically locked up between two valves or flow con- 
trol components can absorb heat and through the increase of pressure cause 
structural failure. 


Solution: 

The system and components should be designed to provide appropriate pres- 
sure relief and thereby preclude unacceptable pressure buildup. Either a 
separate relief system may be incorporated into the system or back-relief 
valves may be built into the components. System relief devices should be 
protected by insulation and perhaps by purging with nitrogen or helium to 
prevent ice blockage of the relief port. 


Condensation of Contaminants Within Cryogenic Systems During Loading 


Problem: 

Loading cryogenic oxygen can result in condensation water or any other 
condensable vapor inside the system. In large systems, even contaminant 
levels measured in parts per million can produce a sizable frozen mass 
that could impede flow or system function. 


Solution: 

Before a cryogenic system is loaded, all air, water, and condensable vapors 
should be purged or evacuated from the system. Experimentation may be 
required to define the degree of purge or the number of evacuation cycles 
required. 
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SYSTEM CLEANLINESS 


System cleanliness is extremely Important in oxygen. Metallic and 
nonmetallic contaminants and nonvolatile residues may be left in compo- 
nents and systems after fabrication and assembly. The component design * 
practices identified in section 4 concerning contaminant generation and 
control are also applicable to system design as are the clean assembly 
techniques discussed in section 6 and the cleaning techniques discussed 
in section 8. 

The designer should recognize, however, that component filters alone 
may not be adequate to handle contaminants built into the system or gen- 
erated at the system/level. Separate system-level filters may be required 
to control particulate contamination, and appropriate system flush and 
purge ports should be designed into the system. 


System Level Filters 


Problem: 

The most rigorous attention to designing a system for clean assembly and 
clean operation and to minimizing contaminant collection areas cannot to- 
tally eliminate contamination built into the system and generated by the 
system during operation. If system-level contamination control and re- 
moval features are not provided, performance and safety may be severely 
degraded. 


Solution: 

Adequate system-level filters should be provided (filtration rating, 
dirt-holding capacity) to handle built-in contaminants and system- 
generated contaminants. The system filters should be located so as to 
protect component filters from contamination overload. 


System Flush and Purge Fittings 


Problem; 

The most rigorous attention to designing a system for clean assembly and 
clean operation and to minimizing contaminant collection areas cannot to- 
tally eliminate contamination built into the system, generated by the sys- 
tem during operation, or introduced into the system during maintenance 
operations. If system-level contamination control and removal features 
are not provided, performance and safety may be severely degraded. 

Solution: 

System flush and purge fittings should be located at appropriate high and 
low points to allow effective flush or purge of the system in all expected 
attitudes. 
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6. CLEAN ASSEMBLY AND INSPECTION 


CLEAN ASSEMBLY TECHNIQUES 

1 

An area of foremost concern in high pressure oxygen systems is contam- 
ination control. Contaminants are the most likely source of readily ignit- 
able material. If they are nonmetallic, then they have relatively low ig- 
nition temperatures. If they are metallic, they have been abraded off metal 
surfaces. Such a product of metallic abrasion will have bare, unoxidized 
metal as a portion if not all of its exposed surface area. This surface is 
readily ignitable when heat from impact, shock, or compression raises the 
local temperature to a critical value. Elimination of all contaminants is 
highly desirable but not totally achievable in complex assemblies which 
include nonmetallic seals, threads, screw lock plugs, press fits, welds, 
soldered and brazed joints, and lubricants. Fortunately, there are some 
beneficial techniques that can be used to minimize the bad side effects of 
these sometimes necessary features. 


Assembling Seals 

Designs that allow or cause harmful cuts or abrasions to the in-place 
seals during assembly can create contaminants and can set up future contam- 
inant generation, as the seal will continue to shed particles during its 
functional life. A typical example figure 31 is the assembly of a shaft 
into a bore containing an 0-ring. The shaft could cut the 0-ring because 
of a nonexistent or Inadequate chamfer on the end of the shaft. Perhaps 
even more common is the forcing of an 0-ring over screw threads to posi- 
tion the seal on a threaded shaft or bolt. The crest of the threads will 
cut and chip the seal, and, if the assembled components are not recleaned, 
then the contaminated item is left in the system. 

Seals should not be forced into bores or over shafts without generous 
chamfers. These parts must be inspected for burrs and sharp edges before 
they are assembled. It is important to note that a chamfer will have a 
sharp edge unless it is specifically removed. Hardened steel may have a 
very pronounced sharp edge at the intersection of the chamfer cut and the 
outer diameter of the shaft. 

Installation of an 0-ring over threads whose major diameter exceeds 
the inside diameter of the 0-ring should be avoided if possible. If this 
danger of cutting into the 0-ring cannot be avoided, then the assembly 
specifications should allow for additional cleaning after the 0-ring and 
the threaded part have been assembled and before the components are in- 
stalled in the next level of assembly. A light coating of seal lubricant 
should be used to ease the assembly. 
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' — Pressed and 
welded plug 


Figure 31.- Contamination generation during assembly. 
NOTE: Care must be exercised in the installation of 
0-rings into bore. 
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Threaded Assembly 

Threaded connections occurring in fluid systems can generate contami- 
nants as the threads are engaged and tightened, as shown in the first il- 
lustration of figure 32. One way to avoid this problem is to redesign the 
threaded members as shown in the second illustration, wherein the smooth 
portion of the plug interfaces with the seal before the threads engage. 

This solution, however, does involve rotating a part against its seal 
causing real damage. Alternately, the in-line threaded feature could be 
replaced with a flanged and bolted connection, which places the threaded 
portions outside the fluid stream, as shown in the third figure. Using an- 
other method, the function of the threaded member can be carried out by a 
separate nut device that is not inserted until the sealing has been accom- 
plished with a push-in plug, as shown in the fourth figure. And finally, 
another option is to install a barrier ring to block the migration of 
particulate matter, as shown in figure 32e. 


Deformable Parts 


Parts such as screw locking devices, usually nonmetallic inserts, 
which function by allowing other parts to deform them are contaminant gen- 
erators. Their use should be limited as much as possible and their instal- 
lation should be sequenced so that they are driven in one time only. Suc- 
cessive assembly and disassembly only compounds the amount of particulate 
created. 


Press Fits 


Press fits generate particles during their assembly from the relative 
motion of the two highly loaded surfaces. These particles can be par- 
tially removed by cleaning the joined parts immediately after pressing 
them together, and this step should be called for on the subassembly draw- 
ing. Direction should be given in the assembly procedure document that 
the installation of press fit, push fit, and threaded valve parts into 
housing bores should be performed with the housing inverted (bore opening 
pointing down) so that assembly-generated contaminants fall away from the 
component rather than into critical flow paths. 


Welded. Soldered, and Brazed Joints 


Welded, soldered, and brazed joints, if left in the as-formed condi- 
tion, may leave slag, roughness, porosity, or cracks which can generate or 
trap contaminants. The use of such joints should be minimized in high 
pressure oxygen components. When the use of welds cannot be avoided, they 
should at least be specified as full penetration so that all contacting 
surface area is joined to prevent entrapment of particulates and eliminate 
uncleanable blind surfaces. Exposed weld surfaces should then be ground 
to a smooth finish to enhance cleaning. 


6-3 


orr'^- 


r Threading generates 
contaminants 


Smooth shaft seals 
before threads engage 





Burrs 


Removal of burrs and sharp edges 1s critical In high pressure oxygen 
systems. Accomplishing this in small -diameter Internal passageways at the 
Intersection of cross drills is a common problem. The best results have' 
been obtained with small, motorized grinding tools and with electrical dis- 
charge machining (EDM). 


Lubricants 


Lubricants should be used wherever necessary to reduce abrasion and 
damage to seals during assembly and to enhance the sealing or sliding of 
parts operationally. Care should be taken, however, to apply lubricants 
lightly and to remove excess to prevent future migration. Only approved 
batch/lot tested lubricants should be used, such as batch-certified Krytox 
240 AC or Braycote 3L-38RP. It should be noted that, although such ap- 
proved lubricants are identified as oxygen compatible, they can react with 
oxygen when system design limits on temperature, pressure, or pressure 
rise rates are exceeded. 
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INSPECTION REQUIREMENTS 


This design guide points out design, assembly, and contamination prob- 
lems that should be avoided in high pressure oxygen systems. The problems, 
their causes, and the means of avoiding them are treated in considera'ble 
detail in the sections on design requirements. The design guidelines re- 
conmended in this document should be reviewed and applicable features 
Incorporated whenever possible. However, even incorporation of as many as 
possible is no guarantee against errors. Therefore, special inspection 
procedures should be used to identify certain problems that are potentially 
dangerous to oxygen systems. 

The problems that tend to increase the ignition hazard in high pres- 
sure oxygen systems and, at the same time, lend themselves to inspection 
are listed below, along with the recommended inspection methods. These ad- 
ditional inspection requirements will increase the overall reliability of 
the system and should be imposed whenever feasible. These additional in- 
spection procedures should be used in conjunction with, not in place of, 
inspection procedures normally used to verify component integrity, cleanli- 
ness, and conformance to specifications. 


Thin Walls 


Radiography (X-ray) is a most effective inspection method for imaging 
and measuring thin walls. Preparation of a clear plastic block figure 
containing all the passageways is a useful inspection aid for visualizing 
distances and tolerances between passageways. An example of a machined 
plastic block is shown in figure 33. Such a block would also aid in visual 
izing the X-ray view required. 


Blind Passages or Dead End Cavities 

Often a dead end cavity is the unintended result of an overdrill. 
X-ray is an excellent inspection method for imaging and measuring dead end 
cavities. There is also some potential for imaging metallic debris in the 
cavity using the X-ray method. Visual examination is another excellent 
method for finding dead end cavities where holes are large enough for a 
borescope to be inserted. 


Feathered Edges and Machine Burrs 

Visual inspection is the most effective means of detecting feathered 
edges and machine burrs when a borescope can be inserted. X-ray has some 
potential for detecting these conditions, but it is limited by orientation 
considerations and the generally large overall thickness of the part com- 
pared to that of feathered edges or burrs. 
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Figure 33.- Machined plastic block. 
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Seal and Filter P 1 acement 


Improper placement of seals, such as reversing the position of seals 
and backup rings, can result in extrusion of the seal or particulate mat- 
ter into the oxygen flow. X-ray is quite effective in imaging metallic . 
seals, backup rings, and filters, while neutron radiography is excellent 
for Imaging hydrogen-bearing nonmetal lie seals and backup rings. 


Debris 


Debris is particulate matter that can cause impact heating when 
carried by a high velocity gas stream or friction heating when entrapped 
between sliding surfaces. Where a borescope can be inserted, visual in- 
spection is the most effective means of detecting debris. X-ray has some 
potential for detecting larger metallic particles, although overall part 
thickness is a limiting factor. Neutron radiography can be used to detect 
hydrogen-bearing nonmetallic debris, but again overall part thickness is 
a limiting factor, although not as pronounced as for X-ray detection of 
metallic debris. Neutron rays are not absorbed by the metal housing as 
readily as X-rays. A third means of detecting debris or loose particles 
is to vibrate the part with acoustic sensors attached to the housing. In- 
spections for debris should be performed after cleaning and could even be 
considered after assembly as a final verification of system cleanliness. 
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RE INSPECTION RECOMMENDATIONS 

Oxygen components and systems should be periodically reinspected to 
ensure that safety and component integrity are maintained during the life 
of the system. Determination of system and component reinspection inter- 
vals has proved to be a complex task. Detailed knowledge of construction 
materials, pressure levels, the use environment, and the service the sys- 
tem is performing must be applied. For example, a system that supplies 
high pressure oxygen to flight hardware is reinspected with greater fre- 
quency and in greater detail than is a low pressure oxygen system in a 
facility welding shop. 

In establishing the reinspection intervals, the following items 
should be considered. 

a) Routine disassembly and reassembly of piping systems invariably in- 
creases the level of system contamination because particulates are 
generated. 

b) Sampling of an assembled system or component for gasborne contami- 
nants yields only limited data on the internal cleanliness of the overall 
system because the ability of flowing gases to entrain particulates is a 
function of particulate mass and identity, gas flow velocity, gas viscos- 
ity, system configuration, and other factors. We must emphasize that this 
method of system sampling cannot be directly correlated with the cleanli- 
ness or contamination of internal component or system surfaces. 

c) The reinspection plan must address the design service life of com- 
ponents. It must identify problems associated with anomalous component be 
havior {such as chatter in check or relief valves, valve Internal leakage, 
and regulator pressure control instabilities) and address the disposition 
of these problems. 

d) Additional insight reganding system contamination levels can be 
gained through systematic inspection of components (e.g., transducers, 
flex hoses, relief valves, filters) removed for calibration, proof- 
testing, or periodic maintenance. 

Reverification of cleanliness levels In components and systems that 
have been in service is the subject of Section 8, Cleaning Requirements. 


6-9 


7. COMPONENT AND SYSTEM-LEVEL TEST REQUIREMENTS 


OBJECTIVES 

A 

The main objectives of individual component and system-level testing 
are to investigate the performance and operating characteristics of the 
individual components, and to then investigate the effects of their 
interaction when assembled and operated as a system. Component testing 
evaluates and verifies that the specified functional performance, life, 
reliability and safety are satisfied; while system-level testing satisfies 
the same purpose at the higher assembly level. Some system components 
such as lines, connectors, flanges, and sensors are tested for the first 
time at the system level. A further objective of system-level testing is 
to define the range of conditions encountered by each component as the 
system is operated over its full specified operating range, and to ver- 
ify that the individual component specifications meet these conditions 
satisfactorily. 


TYPES OF TESTING 

Three types of component and system-level testing are of interest - 
engineering development tests, qualification tests, and acceptance tests. 


Engineering Development Tests 

The complete range of functional requirements, the entire spectrum of 
imposed environmental conditions, and the full life capability of the com- 
ponents and system should be demonstrated in engineering development 
tests. Hardware of the highest fidelity possible should be used and the 
tests should be done with oxygen. The purpose of these tests is to come 
to a full understanding of the performance of the component and system 
over the full specification range while it is still possible to change the 
hardware. Engineering development tests are not burdened with the rigor- 
ous discipline of full quality control coverage. Satisfactory engineering 
development tests of adequate scope can help to guarantee a successful 
formal qualification program. 

Consideration should be given to running selected off-limits tests to 
determine the real limits of the components and system. Such testing may 
be particularly valuable where hardware performance margins are not known, 
where single point failures may exist, or where uncertainty exists in the 
specifications. 


Qualification Tests 

These components and systems must demonstrate under full quality con- 
trol discipline their functional performance enabling them to withstand 
the possible stresses and to meet the environmental conditions of their ap 
plication, their life expectancy, and their safety and reliability. Quali 
fication tests are performed on hardware of the highest possible fidelity 
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with the test system arranged as close to the actual configuration as pos- 
sible. These tests must be run with oxygen. The component or system is 
always subjected to a formal acceptance test as the initial portion of the 
qualification test. 

Higher level qualification testing, often called verification test- 
ing, is frequently done on an oxygen system to verify that it integrates 
satisfactorily with other vehicle systems. An example is an integrated 
vehicle test in which the system software is verified to operate the sys- 
tem satisfactorily. Other examples are large-scale vibro-acoustic and 
thermal tests. 


Acceptance Tests 

In acceptance testing, the component or the as-built system must dem- 
onstrate that it meets functional requirements, is safe, and is compatible 
with oxygen as its working fluid. 


GENERAL SYSTEM TEST REQUIREMENTS 

Several considerations are common to all three types of component and 
system- level testing. 

The fidelity of both the hardware and the test system geometry should 
be at the highest level possible for all tests. 

Cleanliness is crucial In oxygen components and systems. Extreme 
care must be taken to ensure that all components have been cleaned by 
approved procedures, that the system has been assembled following approved 
procedures, and that its cleanliness has subsequently been verified as 
meeting the standards for gaseous and liquid oxygen usage. See sections 
6 and 8 of this handbook for recommended inspection and cleaning standards 
and procedures. 

All fluids to be put into the test system must first be sampled from 
the ground service equipment and analyzed to verify acceptable quality. 

All fluids introduced into the test system for system-level tests must be 
filtered to an appropriate level at the system-loading interface. The 
ground system filters must be as fine as or finer than the finest onboard 
filter to keep from loading into the system particulates that would reduce 
the capacity and life of the flight system filters. After the test, sam- 
ples of fluids should be removed from the test system for analysis and fil- 
tration. These tests should detect any change in fluid properties or deg- 
radation in fluid quality. They should also detect any particles picked 
up by the fluid which may indicate failure, incipient failure, or design 
problems within the system. 

As a cryogenic liquid is loaded into a test system, care must be 
taken to avoid excessive thermal shock and to prevent pressure vessel im- 
plosion due to pressure collapse. 
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Care must also be taken to verify that insulation is properly in- 
stalled on cryogenic areas to prevent excessive ice buildup on the test 
system. 

All ground service equipment should be carefully assessed to verify* 
its adequacy to support the test requirements under both normal and contin- 
gency operations. 

Test designers must verify that any nonflight hardware or instrumen- 
tation used in component or systems testing does not compromise the test 
objectives or system safety. In particular, if any instrumentation such 
as a pressure transducer is connected into the system by a tube stub, the 
test director should ensure that the orientation of the tube does not 
cause it to act as a contaminant collection point, that the tube stub does 
not become an acoustic heating cavity source, that the potential for cav- 
ity compression heating is minimized, and that the instrument is supported 
to avoid vibration failure. 


TEST PROGRAM CONTENT 

Much of the recommended test program content for engineering develop- 
ment tests, qualification tests, and acceptance tests is the same for both 
individual components and for system-level tests. 

Engineering development tests should include the following as a 
minimum. 

1. Pretest flow and functional validation tests, including tests of 
instrumentation operation. These tests to verify that the test system and 
components are operating correctly should be performed with a clean inert 
fluid. 


2. Stress testing. These tests exercise the system over the entire 
combined range of test parameters {pressure, temperature, flow), concen- 
trating on those combinations of paratneters which produce the worst system 
stress. Stress testing can be accomplished by operating the component at 
test pressures that exceed the highest pressure and temperature expected 
in operation by at least 10 percent. Facility and ground support equip- 
ment should be chosen so that its maximum allowable working pressure 
(MAWP) is sufficiently above planned use levels to allow a 25-percent test 
pressure margin and still be below the MAWP. In addition, flight equip- 
ment should be exposed to a pneumatic surge (gaseous Impact) at least 
twice the rate it is expected to experience in use. Pressure rise rates 
from 20,000 to 100,000 lb per in^ per second (140 to 690 MN per m^ per 
second) are commonly used. A rapid pressure surge can, by the process of 
adiabatic compression of the oxygen, heat internal soft goods or assembly- 
generated contaminants to their ignition temperatures. If a component 
passes this test phase, user confidence should be significantly enhanced. 
Stress tests must be performed using oxygen. These tests demonstrate the 
ability of the component or system to operate over the required range of 
parameters satisfactorily, and with some safety margin. 
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3. Environmental testing. These tests expose the component or sys- 
tem, both operating and nonoperating, to the application's expected range 
of environmental conditions (temperature, pressure (or vacuum), humidity, 
sand and dust, rain, acoustics, vibration). Environmental tests must be 
performed with oxygen in the system. These tests demonstrate the ability 
of the component or system to operate satisfactorily in the expected envi- 
ronment. 


4. Life cycle tests. These tests to assure that the system will 
last the planned lifetime may include mechanical cycles, thermal cycles, 
pressure cycles, and load cycles. These te sts must be performed with oxy- 
gen. The number of cycles to be performed is determined from the 
anticipated use. For flight equipment, the number of test cycles Is typi- 
cally specified to be 4 times the expected life cycles for each opera- 
tional mode. For facility and ground support equipment, which is usually 
designed and constructed for longer life and a greater factor of safety 
than flight equipment, the number of cycles is typically limited to that 
required to demonstrate functionality and oxygen compatibility; however, 

a statistically significant number of cycles should be performed in each 
operational mode. Experience indicates that 50 cycles in each mode should 
identify inherent operational problems. 

5. Posttest flow and functional validation tests. These tests to 
identify any changes in component or system performance resulting from the 
test program or from exposure to oxygen should follow the same procedures 
used for the pretest flow and functional validation. 

6. Disassembly and inspection. After the engineering development 
tests have been con?)leted, system components should be examined in detail 
to identify evidence of damage, wear, failure, or incipient failure. Spe- 
cial attention should be directed to the condition of soft goods and the 
presence of contamination. Sources of any observed contamination should 
be thoroughly investigated. In this manner, anomalies such as fretting, 
overstressing, and other functionally introduced failures can be identi- 
fied and corrected before the cwnponent is put into use. 

Qualification tests should always begin with the approved acceptance 
test. Thereafter, the qualification test program should be as described 
for the engineering development tests. Qualification tests, of course, 
are conducted under the discipline of full configuration control, detailed 
test procedures, and specified pass/fail criteria. All qualification 
tests (except the pretest flow and functional validation) must be per- 
formed using oxygen. 

Acceptance tests should include the following as a minimum. 

1. Pretest flow and functional evaluation to verify that the compo- 
nent or system Is operating correctly, meets specifications, and has the 
same performance characteristics as the qualification component or system. 
This evaluation should be conducted with an inert fluid that meets cleanli'* 
ness standards. 


7-4 


2. Flow and functional tests, including limited cycle testing, using 
oxygen to verify system compatibility. Cycle testing should be an abbre- 
viated version of the qualification test procedure. To ensure safety and 
functionality, pressure and temperature levels should exceed the maximum 
anticipated use levels. The number of cycles should be only that needed ' 
to demonstrate oxygen compatibility. During cycle testing, each component 
should be evaluated for functional anomalies. 

3. Posttest flow and functional evaluation using oxygen. 


TEST PROGRAM EVALUATION 

In all tests, special attention should be paid to the detection of po- 
tentially dangerous characteristics— pressure surges, sustained pressure 
oscillations, standing acoustic waves in cavities or blind passages, valve 
or regulator chatter, frictional contact of component parts, etc. 

Any time an anomaly is detected, the system or component should be 
disassembled and inspected to determine the corrective action that must be 
taken. 

Any discrepant or anomalous hardware must be subjected to an estab- 
lished system of controlled review, rework, and reinspection before it is 
considered for reuse. 
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8. CLEANING REQUIREMENTS 


Cleanliness {contamination control) is critical in oxygen components 
and systems. There are two obvious reasons. First, contamination levels 
may be sufficient to cause functional anomalies such as leaking valves or 
regulators. Second, the presence of contamination can cause ignition of 
components or systems by a variety of mechanisms such as particle impact, 
mechanical or pneumatic impact, or spontaneous ignition. These mechanisms 
are discussed more thoroughly in other parts of this handbook. 

The cleaning of an oxygen system should begin with disassembly to the 
elemental or piece part level. If cleaning is attempted by flowing solu- 
tions through a component, vulnerable internal elements may be damaged by 
the solutions required to clean the major elements of the component. Also 
contaminants and cleaning solutions may become entrapped in component 
recesses and may ultimately react with oxygen. When the component has 
been disassembled, the parts should be grouped according to the method of 
cleaning. Special cleaning procedures must be developed to remove en- 
trapped contaminants. Disassembly also allows assessment of the service- 
ability of the component elements. If sealing surfaces are damaged or 
cracks are observed in the metallic parts, the component must be repaired 
or replaced. Special attention should be directed to the component soft 
goods. Damaged or worn soft goods should be replaced with soft goods from 
the same batch if possible. If soft goods of the same batch are not avail- 
able, requalification of each component with the new batch of soft goods 
is recommended unless oxygen compatibility can be established by other 
means. 

Each system and component element must be subjected to cleaning 
processes which employ the following general techniques. 

Precleaning of individual parts must be performed to remove contami- 
nants from readily accessible surfaces. The first step should be a 
degreasing of the surfaces. Nonmetallics and used metallic parts can be 
adequately degreased by rinsing with trichlorotrifluoroethane (Freon PCA, 
MIL-C-81302B, amendment 1, type II); newly machined parts and unusually 
dirty parts should be vapor-degreased using trichloroethylene or 1,1,1- 
trichloroethane. Caution must be exercised in the use of vapor degreasing 
since some metals, such as magnesium, could react with the degreasing sol- 
vent. Various cleaning solutions can then be en^loyed in conjunction with 
ultrasonics. Commonly used cleaning solutions include the following. 

Alkaline cleaning solution, typically contains sodium hydroxide, so- 
dium carbonate, sodium metasilicate, sodium phosphates, and surface-active 
(wetting) agents. Such solutions may be used at temperatures up to 180° F 
(355 K). An example is Oakite HD126. 

Acid cleaning solution, which typically contains phosphoric acid, 
ethylene glycol monobutyl ether, and wetting agents. These solutions may 
be used at temperatures up to 150° F (338 K). Oakite 33 is an example. 

Mild alkaline liquid detergent, which typically contains anionic and 
nonionic surface-active agents, chelating agents, and sodium metasilicate. 
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Such a detergent may be used at temperatures up to 180° F (355 K). Exam- 
ple: Oakite Liqui-Det 2. 

Rust and scale remover, which typically contains sodium hydroxide (at 
much higher levels than in an alkaline cleaning solution), sodium carbon- 
ate, surface-active agents, and chelating agents. Such solutions are used 
from 160° F (344 K) to boiling. Oakite Rustripper is an example. 

The sequence of cleaning solutions to be used depends on the material 
to be cleaned. Stainless steels (300 series). Monel, and Inconel normally 
are cleaned in alkaline solution and then in acid solution. Carbon steel 
is cleaned by rust and scale remover, if required, followed by alkaline so- 
lution. Copper and brass are cleaned in alkaline solution and briefly in 
acid. Aluminum is cleaned in liquid detergent. Soft goods are cleaned in 
liquid detergent except for Teflon, which may be cleaned in alkaline solu- 
tion followed by acid. Other specialized materials may require different 
sequences, and consideration must be given to metals' reactivity. Other- 
specialized solutions such as pickling or metal-brightening (chromic acid) 
solutions may also be employed. A thorough water rinse between cleaning 
solutions is mandatory. Following the last water rinse, the parts should 
be flushed with isopropyl alcohol, then Freon PCA. During the entire 
cleaning process, the parts should be visually inspected and mechanically 
cleaned when necessary. Visual inspection should be required before final 
cleaning since gross chemical contamination cannot be removed in final 
cleaning. 

The precleaned parts should then be moved to a clean room. We have 
found that a Class 100 laminar flow environment, as defined in Federal 
Standard 209B, is adequate. Final cleaning, sampling, and analysis is 
performed by rinsing each part with Freon PCA, then sampling the rinse 
fluid. Soaking in an ultrasonic Freon PCA bath may be necessary to remove 
particulates. The volume of rinse fluid retained for sampling and anal- 
ysis is directly related to the rinsed part surface area; e.g., 100 ml/ft^ 
(1080 ml/m2). The rinse fluid is filtered to ascertain the particulate 
contaminant levels; then the fluid is subjected to chemical analysis for 
determination of total hydrocarbon content. 

Additional information may be obtained from applicable sections of 
JSCM-5322B, 1982, "JSC Contamination Control Requirements Manual." 

A typical particulate specification that has been found to be adequate 
for oxygen systems Is shown In the following table. 


MAXIMUM ALLOWABLE PARTICULATES PER SQUARE FOOT 
(PER SQUARE METER) OF CRITICAL SURFACE 


Particle size range 
(urn)* 

Maximum 

quantity 

Per S( 
meter 

0-10 

No silting 
permitted 

None 

11 - 25 

85 

915 

26 - 50 

8 

86 

51 - 100 

4 

43 

>100 

0 

0 

Fiber length (ym) 



100 - 175 

1 

11 

>175 

0 

0 


In addition, a total hydrocarbon content (THC) assessment should be 
performed in lieu of the normally specified nonvolatile residue (NVR) as- 
sessment. Determination of THC permits a qualitative as well as a quanti- 
tative measure of the effectiveness of the cleaning process. Since the 
THC limit of 3 yg/ft^ (32 yg/m^) of cleaned surface area (based on a 100- 
ml sample of flushing fluid) is far more stringent than the normal NVR 
specification of 1 mg/ft^ (11 mg/m^), users of this THC process can be 
better assured that their hardware is essentially free of nonparticulate 
contaminants.* 

Experience has shown that approximately one-half of all parts cleaned 
will fail to meet either the particulate or the THC specification on the 
initial sampling; consequently, recleaning is required until all parts 
pass both specifications. 

After a part has been cleaned to these specifications, it should be 
bagged by itself in FEP Teflon film. The Teflon used for bagging oxygen 
system parts should be as clean as the item being packaged. Teflon has 
been chosen for the initial packaging of oxygen system parts over such al- 
ternative materials as polyethylene and nylon because its surface is rela- 
tively nonshedding, it is more easily cleaned, and it is rrore oxygen com- 
patible. Some drawbacks of Teflon are its high cost, Its tendency to de- 
velop an electrostatic charge which attracts particles, and its permeabil- 
ity to water. To reduce particulate contamination, the part is sealed in 
the Teflon bag while in the final cleaning area (laminar flow clean room) 
using a special heat sealer. The Teflon bag is then covered with a poly- 
ethylene outer bag which is heat sealed. This outer bag protects the 
Teflon and the part from abrasion, statically attracted particles, and 
moisture. A label should be affixed to each bagged part to document the 
cleanliness level achieved. 

* ym is micrometer, yg is microgram, mg is milligram. 
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After system and component disassembly and cleaning, reassembly of 
components and systems must be stringently controlled to assure that the 
achieved cleanliness levels are not compromised. All components requiring 
reassembly (such as valves, regulators, and filters) should be reassembled 
in a filtered-air environment such as a Class 100 clean room or flow 
bench. Personnel should be properly attired in clean room garments and 
gloves. All tools that contact component internal must be cleaned to the 
specified levels. Only approved lubricants such as batch-certified Krytox 
240 AC or Braycote 3L-38RP should be used, and then sparingly. Bear in 
mind that lubricants, although identified as oxygen compatible, can react 
with oxygen when system design temperature, pressure, or pressure rise 
rate limits are exceeded. Also, a lubricant can migrate into an area that 
should not be lubricated, thereby causing functional anomalies (such as 
regulator control mechanisms that fail to respond properly because of con- 
tamination by excess lubricant). 

Reassembly of systems should be accomplished in a manner which mini- 
mizes contamination of the system. Some techniques commonly employed in- 
clude buildup of the system as subassemblies using the same techniques as 
for components (filtered-air environment, etc.). When the size or loca- 
tion of a system precludes this practice, a low pressure purge of the sys- 
tem by a clean inert gas during reassembly or a portable clean tent can be 
used to reduce contamination. 

After the system has been reassembled, a pressure integrity and leak 
test should be performed, using an appropriately filtered inert gas that 
has been analyzed for contaminants. Then the system should be purged with 
a high pressure, high volume clean Inert gas in an attempt to mobilize and 
remove any particles generated during reassembly. After this purge or 
"blowdown," the system may be vented, then pressurized with oxygen. It is 
a good practice to perform the first oxygen pressurization of a system by 
remote control since ignition of assembly-generated contaminants can occur. 

System cleanliness verification and reverification procedures should 
be performed whenever significant disassenAly and reassembly has occurred 
or contamination is suspected. Also, if the oxygen system contains com- 
ponents with a history of in-service failure, appropriate traps (e.g., 
filters) or other easily analyzed components should be removed, inspected, 
and replaced periodically. 

Oxygen systems can be sampled for gasborne particulates by attaching 
a filter to each outlet of the test system and then flowing a clean inert 
gas or oxygen through the filter as fast as is possible without exceeding 
the maximum allowable working pressure for either the filter or the sys- 
tem. A better measure of the system’s ability to deliver oxygen of a de- 
sired cleanliness can be taken if the sample flow rate exceeds the sys- 
tem end-use flow rate. The quantity and size as well as the type of par- 
ticulate can be determined by performing a chemical/metallurgical anal- 
ysis of the trapped particles. 

Gasborne particulate analysis is commonly used on a gas sampling vol- 
ume of 35 standard cubic feet (1 cubic meter). Using a standard volume 
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pennits direct comparison with other gasborne particulate samples; how- 
ever, this method of system sampling is not directly correlative to the 
sampling of internal component or system surfaces. 

Oxygen systems can be sampled for surface-borne particulates and 
hydrocarbons, halocarbons, and other nonvolatile residue by removing sys- 
tem lines or components that lend themselves to contaminant entrapment, 
either by position or design (e.g., a system low point or a filtering 
device) and subjecting the lines or components to sampling and analysis. 
Specific solvents may be used to separate selected materials; e.g., carbon 
tetrachloride may be used to dissolve halocarbon oil without also mob- 
ilizing Krytox or Braycote lubricants. Arter a line or component has 
been flushed or visually inspected, it should be recleaned before it is 
reinstalled in the oxygen system. 

In summary, while cleanliness will not make a poorly designed fab- 
ricated system safe, contamination can cause the best systems and compo- 
nents to be hazardous. 
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9. SUMMARY 


Much analytical and experimental work has been done in recent years 
to broaden the understanding of the ignition-triggering mechanisms and 
physical combustion processes of metallic and nonmetal lie materials in 
pure oxygen environments. However, because of the immense complexity of 
this many-faceted problem, little headway has been made in developing 
analytical models for the design of such systems. On the other hand, major 
progress in advancing the ability of oxygen systems to cope with the de- 
mands for higher performance, pressures, temperatures, etc., has been made 
through the application of empirical testing of materials in configura- 
tions representing their intended uses and through the use of design tech- 
niques which protect or shield the more susceptible nonmetal lies from di- 
rect impingement or interface with the oxygen. This handbook, therefore 
is an attempt to document the practical "state-of-the-art" which has been 
developed by a significant element of the Aerospace community in recent 
years for the design of high pressure oxygen systems. 

This handbook presents a unique and useful synopsis of a great bulk 
of data on the ignitability of both metal lies and nonmetallics in oxygen 
at various pressure conditions. The synthesis of this data is indeed a 
tremendous time saver since it allows the designer to deduce at a glance 
the better performing materials for oxygen usage. Furthermore, the 
handbook also presents many examples of proven component design features 
along with illustrations of undesirable features which should be avoided. 
Additionally, the handbook treats the important aspects of component and 
systems testing and cleaning and handling, information derived from many 
thousands of manhours of effort directed toward the Improvement and perfec- 
tion of manned space vehicles. By careful attention and utilization of 
the recommended detailed component and systems design features prescribed 
herein, along with the adherence to the limited but adequate list of 
recommended materials, the designer should be in a good posture to avoid 
the many pitfalls and problem areas that have been experienced by others 
in the past. When requirements dictate the use of materials not contained 
on the recommended list, the designer should proceed with caution and ver- 
ify design adequacy by appropriate component and systems configuration and 
overstress tests. 
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